While doing some testing, I have accidentally revoked Read permission for "Authenticated users" on a user in AD, and now I can not grant it again, because user is "invisible".

I've done the following:

  1. Open MMC / Active directory users and computers
  2. Switch to advanced view (View/Advanced features)
  3. Right click the user
  4. Select Security tab
  5. Click on "Authenticated users" group
  6. Select "Read" permission (none of the check boxes were checked)
  7. Check the "Deny" checkbox, and confirm the dialogs

The user was shown as "Unknown" for a while in MMC, and now it completelly disappered. So I can not right click him to restore permission :-)

I have tried serveral tools to restore the access, but was unable to do it.

Some sources indicates, that dsacls.exe can be used to print out ACLS and restore them to AD schemas defaults. However, it looks like that even dsacl can not access the object. AdFind.exe does not find him too.

The user is not deleted, so Sysinternal's adrestore.exe is of no use, too.

The user is currently logged int, but he is unable to send and receive emails- It disappeard in Exchange too.

I thought that I will still be able to enumerate the user (I haven't revoked List children permission).

Can I reset the permission on parent OU? I am afraid, that this wuold apply the same permission to all users in this OU (Which I do not want).

Any ideas?

I am using Windows 2003 R2 domain.



You will need to do an authoritative restore for that user. That's going to be the most effective way to repair the user account without affecting any other users in your OUs. The official guide to doing that is here - https://technet.microsoft.com/en-us/library/cc779573(v=ws.10).aspx

| improve this answer | |
  • Thanks. 1) I only have single domain controler. Is an authoritative restore still nedded? 2) In AD restore mode, will I be able to select the user (it can not be read) or will I need to restore parent container? 3) The link explains that during restore, attributes are merged and that "Authoritative restore affects only the objects and attributes that existed at the time of the backup." The security descriptor (is it an attribute?) did not exist for the user. Will it be removed during the restore? – matra Aug 22 '15 at 5:06
  • Yes, you are basically going to back to an earlier version of AD from backup and increasing the USN so it becomes more current and overwrites your error. You should just be able to select the user and not need to restore an entire container. – Jennelle Crothers Aug 24 '15 at 16:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.